From system state to defensible evidence

Evidence Collection

Choose a proportionate collection method, minimise unnecessary change, and preserve enough context for another analyst to understand and verify the evidence.

Find my pathStart the foundations

Evidenceidentified and preserved

3collection routes9practical tools1traceable record

01

Follow a defensible workflow

Select each stage to see how collection decisions protect evidence value.

01ScopeDefine authority and purpose 02PrioritiseProtect short-lived evidence 03AcquireUse a suitable method 04VerifyCheck integrity and coverage 05PreserveKeep evidence traceable

Stage 1Define the question and authority

Record the system, owner, time range, investigation question, and actions you are authorised to perform.

Ask: What decision must this evidence support?

02

Choose the collection path

Start with the evidence that best answers your question, not the tool with the longest feature list.

I need a rapid live triage I need a disk image I need volatile memory

Best matchStart with live response and triage

Collect targeted system state and high-value artefacts while the computer is running.

Fast, targeted collectionLive Response & TriageAssess a running system and collect high-value artefacts with a recorded plan.Level Beginner Setup Running Windows system Time 30 to 90 minOutcome Build an initial evidence picture and identify the next collection step. Persistent storageDisk AcquisitionCreate a verified forensic image while recording source, method, and limitations.Level Beginner to intermediate Setup Source and destination storage Time 1 hour+Outcome Produce a traceable image suitable for later examination. Volatile evidenceMemory AcquisitionCapture physical memory before processes, connections, or credentials disappear.Level Intermediate Setup Running Windows system Time 15 to 45 minOutcome Preserve a memory image with the context required for analysis.

03

Build your foundation

Learn the decision-making behind each collection route before using the tools.

1

Running systemsUnderstanding Live Triage

Prioritise questions, volatile state, and targeted artefacts.

2

Persistent storageUnderstanding Disk Acquisition

Choose an image type and verify integrity.

3

Volatile stateUnderstanding Memory Acquisition

Capture memory safely and record system context.

04

Choose a tool by collection need

Select the evidence need first. The recommendation points to one practical starting guide.

TRITargeted triageCollect selected artefacts quickly REMRemote collectionQuery one or more endpoints DSKDisk imagingAcquire persistent storage RAMMemory capturePreserve volatile memory

Best starting point for targeted triageKAPE

Collect and process selected forensic artefacts quickly using repeatable targets and modules.

Also consider Velociraptor for remote collection or Kansa for PowerShell-led triage across Windows systems.

Explore KAPE

05

Check collection readiness

Confirm the basics before acquiring evidence from a real or simulated system.

!

Preparation required5 checks remaining.

I own the system or have documented authority to collect from it. I recorded the source, system time, investigation question, and intended scope. The destination has enough capacity and appropriate access controls. I recorded the tool version, settings, and expected effect on the source. I have a plan to verify, label, store, and document the acquired evidence.